Open source is not decentralized

Damn Interesting moved to a paid model. Long-form technical writing, published since 2005, now gated behind a subscription. The signal is not the paywall. It is what the paywall indicates. A single source of deep technical analysis, funded directly by its readers, produced by a small team on limited runway, is a concentration of value in one place. Concentrated value is a target. This is not a judgment on the site or its economics. It is a description of the failure mode that concentration produces, and security research sits inside the same failure mode.

The security ecosystem runs on individuals. Not institutions. Individuals. The critical dependencies that hold up production infrastructure are maintained, in many cases, by one person with no funding and no succession plan. That is not a rhetorical claim. It is the documented root cause of the largest supply chain events on record.

CVE-2024-3094. CVSS 10.0. The xz-utils backdoor. liblzma, a compression library linked into OpenSSH through systemd on several distributions, carried a backdoor inserted by a maintainer who spent roughly two years building trust before committing it. The implant hooked symbol resolution through an IFUNC resolver and redirected a function in sshd’s authentication path, yielding a private-key-gated remote code execution backdoor. The project had one exhausted primary maintainer. The attacker, operating as “Jia Tan,” applied social pressure over a long horizon, took over release engineering, and shipped a modification to the build process that injected malicious object code during compilation. It was not caught by code review. It was caught by Andres Freund, a Microsoft engineer, investigating half a second of SSH login latency and abnormal CPU. The most severe supply chain implant of the decade was found by one person noticing a performance anomaly. That is the margin the ecosystem operates on.

CVE-2021-44228. CVSS 10.0. Log4Shell. A JNDI lookup feature in Log4j 2 allowed a crafted string in a logged field to trigger a remote class load. Attacker-controlled input in a log line became remote code execution. T1190, exploitation of a public-facing application. Log4j is maintained by volunteers under the Apache Logging Services project. A component present in a large fraction of Java applications on earth was carried by a handful of unpaid contributors.

CVE-2014-0160. Heartbleed. A missing bounds check in OpenSSL’s TLS heartbeat extension allowed a buffer over-read that leaked up to 64KB of process memory per request - private keys, session tokens, credentials. Affected OpenSSL 1.0.1 through 1.0.1f. At the time, OpenSSL, the cryptographic bedrock for most of the internet, ran on a marginal budget and a very small core team. The Core Infrastructure Initiative was formed afterward specifically because the sustainability gap was the finding.

The pattern is consistent. Critical technical output is produced by under-resourced individuals and small teams. The funding does not match the criticality. That mismatch is the enabling condition, the same way an over-provisioned CI token is the enabling condition in a pipeline compromise. The delta between what the work requires and what sustains it is the exposure.

The economics of finding the bugs are as thin as the economics of maintaining the code. A working browser renderer exploit chain sells to offensive brokers for six or seven figures. The same bug class reported through a vendor program pays a fraction of that, sometimes nothing when it is ruled a duplicate or out of scope. Disclosure work - the write-up, the coordination, the root-cause analysis that teaches the next researcher - pays least of all, and is usually done unpaid on personal time. The offensive market is liquid and well capitalized. The defensive and educational side runs on goodwill and thin subscriptions. That asymmetry is why deep analysis is hard to sustain, and why the few sources that produce it consistently become concentrated, and valuable, and exposed.

Now apply this to a centralized, paid source of deep technical analysis. Two exposures stack.

The first is continuity. A single team on subscription revenue is a single point of failure for the analysis it produces. Burnout, funding shortfall, or a maintainer walking away removes the output. This is the xz condition restated in editorial form. The value depends on people whose sustainability is not guaranteed.

The second is targeting, and this is the one defenders underrate. A concentrated, high-trust source read by practitioners is a watering hole by definition. Adversaries already target the research community directly. In January 2021, Google’s Threat Analysis Group documented a DPRK-attributed campaign against vulnerability researchers. The actors built credible security-researcher personas across social media, ran a technical blog to establish legitimacy, and collaborated on real proof-of-concept work to gain trust. Delivery came two ways. A malicious Visual Studio project with a hidden build event, mapping to T1195.001, compromise of development tools. And a watering-hole browser exploit that compromised fully patched Windows 10 and Chrome installations belonging to researchers who merely visited the blog, mapping to T1189, drive-by compromise. The target was not enterprises. The target was the people who find the bugs.

A trusted, centralized analysis platform is the same target with a larger reader base and a payment system attached. Compromise of that platform yields three attacker outcomes. Watering-hole delivery to a self-selected audience of high-value technical users. Subscriber data and payment metadata - identities, emails, and in some cases employer domains that map directly to the systems those readers defend. And trust abuse, where the content itself becomes a delivery surface: a poisoned code sample, a trojaned PoC repository, or a modified download links a reader to implant. T1195 for the supply chain vector, T1566 where the platform’s mailing list becomes the phishing channel, T1189 for the browser delivery path.

In telemetry, a watering-hole compromise of a content site is quiet on the server side and subtle on the client. The reader’s endpoint shows a browser process making an outbound connection to an unexpected host, Sysmon Event ID 3, followed by renderer behavior that deviates from rendering. Process creation of a child under the browser, Sysmon Event ID 1, is the high-signal event, but modern renderer exploits often stay in-process and never spawn a child, so the strongest indicator does not fire. Image loads of unusual modules, Event ID 7, and script interpreters invoked post-exploitation, T1059, are the fallbacks. On the platform side, the defender sees very little. A compromised CDN asset or a modified JavaScript bundle looks like normal content delivery. Subresource integrity would catch a substituted script. Most content sites do not enforce it. The gap is that the reader trusts the source, and trust suppresses scrutiny. That is precisely what a watering hole exploits.

For a defender monitoring their own researchers as high-value users, the correlation that matters is browser-to-anomaly. EDR alert categories that fire are exploitation-behavior and suspicious-child-process, when a child spawns. When it does not, the surviving signal is network: first-seen destination, rare-domain scoring, and TLS to infrastructure with no prior history for that host. SIEM correlation that pairs a visit to a known technical resource with an immediate outbound to a low-reputation host is the detection with a chance. It is a weak signal. It depends on the exploit being noisy. Renderer-only chains are not.

There is a regulatory dimension for anyone in critical infrastructure. Australia’s SOCI Act frames concentration and critical-dependency risk as something operators must actually account for. A single external source that a defensive team depends on for technical intelligence is a dependency. If that source is compromised, the dependency becomes a delivery path into the people responsible for critical systems. Concentration risk is not abstract for operators who report under that regime.

None of this makes the paywall wrong. The paywall is a rational response to an unsustainable model. Free, deep, correct technical analysis has no funding mechanism that matches its cost. Advertising rewards volume, not depth. Donations do not scale to salaries. Subscription is the honest answer to real economics. The point is narrower and harder. Charging for the work fixes the revenue problem. It does not fix the concentration problem. It arguably sharpens it, because a paid platform now holds subscriber identities and payment infrastructure alongside its reader trust, and that combination is a richer target than a free blog ever was.

The residual exposure after the “patch” - the move to paid - is structural and unchanged. Deep technical knowledge still flows through a small number of under-resourced nodes. Those nodes are still single points of failure for both continuity and compromise. The xz backdoor, Log4Shell, and Heartbleed were the same finding wearing different CVEs: criticality concentrated in places without the resources to defend it. A commercial analysis source is another such node. It will be valued for its concentration and targeted for the same reason.

The fix is not a control anyone deploys. It is distribution. Redundant, independently maintained sources of technical analysis. Funding that reaches maintainers before the anomaly, not after the incident. A research community that does not route its trust through a single high-value endpoint. Until that exists, the model holds. Whatever concentrates deep technical value, and is trusted by the people who defend systems, is a target. Damn Interesting going paid is not the failure. It is the indicator that the node is under load.